tmux statusline: directly-held WAN/LAN IP, offline ✕, native window-status

- tmux-ip: show the first directly-held public/WAN IP on a non-tunnel interface,
  else the LAN/private IP. No external 'what's my IP' lookup and no DigitalOcean
  special-case (a droplet's eth0 public IP is found by the same interface scan);
  RFC1918/link-local/CGNAT classed as not-WAN, so a NAT'd box shows its LAN IP.
- tmux-net: show ✕ when there's no local IP and no VPN tunnel (offline). VPN ⇡
  overlay unchanged.
- .tmux.conf: window-status icon + path now native tmux formats (no per-redraw
  #() forks); tmux-window-icon kept as fallback.

.local/bin/tmux-net

@@ -3,6 +3,7 @@
 # Emit the tmux status-bar network segment.
 #   No VPN:  "⌂ <local_ip>"
 #   VPN up:  "⌂ <local_ip> / ⇡ <vpn_ip>"
+#   Offline: "✕"   (no local IP and no VPN tunnel)
 #
 
 set -u
@@ -10,7 +11,9 @@ set -u
 local_ip=$("$HOME/.local/bin/tmux-ip" 2>/dev/null || true)
 vpn_ip=$("$HOME/.local/bin/tmux-vpn-ip" 2>/dev/null || true)
 
-if [ -n "${vpn_ip:-}" ]; then
+if [ -z "${local_ip:-}" ] && [ -z "${vpn_ip:-}" ]; then
+  printf '\xe2\x9c\x95\n'                                       # ✕  no active connection
+elif [ -n "${vpn_ip:-}" ]; then
   printf '\xe2\x8c\x82 %s / \xe2\x87\xa1 %s\n' "${local_ip:-}" "$vpn_ip"
 else
   printf '\xe2\x8c\x82 %s\n' "${local_ip:-}"